HARDWARE BASED DETECTION DEVICES FOR DETECTING NETWORK TRAFFIC CONTENT AND METHODS OF USING THE SAME

• US 20160381045A1
• Filed: 06/20/2016
• Published: 12/29/2016
• Est. Priority Date: 07/19/2002
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael
• Granted Patent: US 10,645,097 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A device for detecting network traffic content is provided. The device includes a first input port configured to receive one or more signatures, each of the one or more signatures associated with content desired to be detected, a second input port configured to receive data associated with network traffic content. The device also includes a processor configured to process the one or more signatures and the data to determine whether the network traffic content matches the content desired to be detected, and an output port configured to couple the device to a computer system of an intended recipient of the network traffic content. The output port passes the network traffic content to the computer system when it is determined that the network traffic content does not match the content desired to be detected.

Claims

1. A method for detecting network traffic content, the method comprising:

receiving one or more signatures, each of the one or more signatures associated with content desired to be detected;

compiling the one or more signatures into a byte stream executable by a processor to control operation of the processor in determining whether network traffic content matches content desired to be detected based on the compiled one or more signatures;

receiving network traffic content; and

processing the compiled one or more signatures and the network traffic content to determine whether the network traffic content matches the content desired to be detected as represented in the compiled one or more signatures;

wherein;

the processing is performed by a device that is a part of a firewall of a computer system;

the one or more signatures are received via a first input port at the device, and the data is received via a second input port at the device, the device having a housing, the first and second input ports associated with the housing, and

at least one of the one or more signatures is codified using one or more predicates which prescribe one or more functions to be executed by the processor to detect the network traffic content.